CVE-2022-31107
Summary
| CVE | CVE-2022-31107 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-07-15 13:15:00 UTC |
|---|
| Updated | 2022-10-29 02:53:00 UTC |
|---|
| Description | Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Release notes for Grafana 9.0.3 | Grafana documentation |
MISC |
grafana.com |
|
| Release notes for Grafana 8.4.10 | Grafana documentation |
MISC |
grafana.com |
|
| Grafana account takeover via OAuth vulnerability · Advisory · grafana/grafana · GitHub |
CONFIRM |
github.com |
|
| Release notes for Grafana 8.5.9 | Grafana documentation |
MISC |
grafana.com |
|
| July 2022 Grafana Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159998 Oracle Enterprise Linux Security Update for grafana (ELSA-2022-5716)
- 160001 Oracle Enterprise Linux Security Update for grafana (ELSA-2022-5717)
- 240559 Red Hat Update for grafana (RHSA-2022:5716)
- 240561 Red Hat Update for grafana (RHSA-2022:5719)
- 240562 Red Hat Update for grafana (RHSA-2022:5718)
- 240563 Red Hat Update for grafana (RHSA-2022:5717)
- 377095 Alibaba Cloud Linux Security Update for grafana (ALINUX3-SA-2022:0144)
- 502435 Alpine Linux Security Update for grafana
- 502866 Alpine Linux Security Update for grafana
- 690904 Free Berkeley Software Distribution (FreeBSD) Security Update for grafana (0859e6d5-0415-11ed-a53b-6c3be5272acd)
- 752731 SUSE Enterprise Linux Security Update for SUSE Manager Client Tools (SUSE-SU-2022:3747-1)
- 752734 SUSE Enterprise Linux Security Update for SUSE Manager Client Tools (SUSE-SU-2022:3751-1)
- 752995 SUSE Enterprise Linux Security Update for grafana (SUSE-SU-2022:4428-1)
- 753255 SUSE Enterprise Linux Security Update for grafana (SUSE-SU-2022:3765-1)
- 754116 SUSE Enterprise Linux Security Update for SUSE Manager Client Tools (SUSE-SU-2023:2578-1)
- 940600 AlmaLinux Security Update for grafana (ALSA-2022:5717)
- 940625 AlmaLinux Security Update for grafana (ALSA-2022:5716)
- 960455 Rocky Linux Security Update for grafana (RLSA-2022:5717)
- 960596 Rocky Linux Security Update for grafana (RLSA-2022:5716)
